[Buildroot] [PATCH] package/wget: fix CVE-2026-58471

* [Buildroot] [PATCH] package/wget: fix CVE-2026-58471
@ 2026-08-20  9:49 Stefan Mueller via buildroot
  2026-08-22 16:40 ` Julien Olivain via buildroot
  0 siblings, 1 reply; 2+ messages in thread
From: Stefan Mueller via buildroot @ 2026-08-20  9:49 UTC (permalink / raw)
  To: buildroot; +Cc: Bernd Kuhls, Stefan Müller

From: Stefan Müller <stemu86@gmx.ch>

Backport the upstream fix for a heap buffer overflow in convert_fname() when growing the iconv output buffer.

Backport to: 2025.02.x

Signed-off-by: Stefan Müller <stemu86@gmx.ch>
---
 ....c-convert_fname-Fix-buffer-overflow.patch | 72 +++++++++++++++++++
 package/wget/wget.mk                          |  3 +
 2 files changed, 75 insertions(+)
 create mode 100644 package/wget/0007-src-url.c-convert_fname-Fix-buffer-overflow.patch

diff --git a/package/wget/0007-src-url.c-convert_fname-Fix-buffer-overflow.patch b/package/wget/0007-src-url.c-convert_fname-Fix-buffer-overflow.patch
new file mode 100644
index 0000000000..5963d98990
--- /dev/null
+++ b/package/wget/0007-src-url.c-convert_fname-Fix-buffer-overflow.patch
@@ -0,0 +1,72 @@
+From c2640fe5171c59f87c58dc9fcb195b2d18b010ee Mon Sep 17 00:00:00 2001
+From: Arkadi Vainbrand <arkadva8@gmail.com>
+Date: Tue, 13 Jan 2026 12:22:04 +0200
+Subject: [PATCH] Fix buffer size handling in filename conversion
+
+* src/url.c (convert_fname): Fix buffer overflow.
+
+Copyright-paperwork-exempt: Yes
+Signed-off-by: Arkadi Vainbrand <arkadva8@gmail.com>
+CVE: CVE-2026-58471
+Upstream: https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee
+Signed-off-by: Stefan Müller <stemu86@gmx.ch>
+
+---
+ src/url.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/src/url.c b/src/url.c
+index 7540e90f..f334456c 100644
+--- a/src/url.c
++++ b/src/url.c
+@@ -1614,7 +1614,7 @@ convert_fname (char *fname)
+   const char *from_encoding = opt.encoding_remote;
+   const char *to_encoding = opt.locale;
+   iconv_t cd;
+-  size_t len, done, inlen, outlen;
++  size_t len, inlen, outlen;
+   char *s;
+   const char *orig_fname;
+ 
+@@ -1636,7 +1636,6 @@ convert_fname (char *fname)
+   inlen = strlen (fname);
+   len = outlen = inlen * 2;
+   converted_fname = s = xmalloc (outlen + 1);
+-  done = 0;
+ 
+   for (;;)
+     {
+@@ -1644,7 +1643,7 @@ convert_fname (char *fname)
+       if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0
+           && iconv (cd, NULL, NULL, &s, &outlen) == 0)
+         {
+-          *(converted_fname + len - outlen - done) = '\0';
++          *s = '\0';
+           iconv_close (cd);
+           DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n",
+                    orig_fname, from_encoding, converted_fname, to_encoding));
+@@ -1667,10 +1666,17 @@ convert_fname (char *fname)
+         }
+       else if (errno == E2BIG) /* Output buffer full */
+         {
+-          done = len;
+-          len = outlen = done + inlen * 2;
+-          converted_fname = xrealloc (converted_fname, outlen + 1);
+-          s = converted_fname + done;
++          size_t used = s - converted_fname;
++          size_t newlen = used + inlen * 2 + 1;
++
++          /* Ensure we actually grow the buffer */
++          if (newlen <= len)
++            newlen = len * 2;
++
++          converted_fname = xrealloc (converted_fname, newlen + 1);
++          len = newlen;
++          s = converted_fname + used;
++          outlen = len - used;
+         }
+       else /* Weird, we got an unspecified error */
+         {
+-- 
+GitLab
+
diff --git a/package/wget/wget.mk b/package/wget/wget.mk
index 015fc0c59e..de758635b3 100644
--- a/package/wget/wget.mk
+++ b/package/wget/wget.mk
@@ -21,6 +21,9 @@ WGET_IGNORE_CVES += CVE-2026-58469
 # 0006-src-http.c-parse_content_range-Use-strtoll-instead-of-strtol.patch
 WGET_IGNORE_CVES += CVE-2026-58470
 
+# 0007-src-url.c-convert_fname-Fix-buffer-overflow.patch
+WGET_IGNORE_CVES += CVE-2026-58471
+
 WGET_CONF_OPTS += --disable-pcre
 
 ifeq ($(BR2_PACKAGE_LIBPSL),y)
-- 
2.25.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 2+ messages in thread